Wireshark EUVD-2026-26331

The exploit requires that a user intentionally open or process a malicious PCAP file or packet capture containing a crafted GNW protocol packet in Wireshark. The GNW protocol dissector must be enabled in the affected version (enabled by default). No special Wireshark configuration or network condition is required beyond the user's action to open the hostile file. Local file access or ability to provide a file to the target user is necessary; remote exploitation is not possible via network packets alone unless Wireshark is actively capturing on a network where an attacker controls traffic. The vulnerability does NOT affect Wireshark instances that do not process GNW protocol traffic or users who do not open untrusted PCAP files.

CVSS 5.5 reflects a medium-priority local availability attack (AV:L/AC:L/PR:N/UI:R). The attack vector is local, meaning the attacker must provide a malicious file or trigger packet capture on the target system, reducing real-world network exposure compared to remote network attacks. However, the low complexity (AC:L) and lack of privilege requirement (PR:N) mean any local user can trigger it. User interaction (UI:R) is required - the victim must open or process the malicious packet file in Wireshark - which slightly lowers practical risk in passive monitoring scenarios but remains significant for incident response teams and security analysts who intentionally analyze suspicious PCAP files. The lack of confidentiality or integrity impact means this is purely a denial-of-service and workflow disruption vector. No EPSS score or KEV status provided; without active exploitation confirmation, treat as a moderate but not critical priority for teams actively using Wireshark for packet analysis. Organizations relying on Wireshark for real-time packet capture and triage should prioritize patching to prevent accidental analysis of hostile PCAP files during incident response.

A security analyst receives a suspicious PCAP file from a colleague investigating a network incident. The analyst opens the file in Wireshark 4.6.2 to inspect packet contents. The file contains a crafted GNW protocol packet with malformed fields that trigger an infinite loop in the GNW dissector. Wireshark freezes, consuming 100% CPU, and must be force-killed. The analyst loses unsaved analysis notes and cannot continue the investigation until Wireshark is restarted or upgraded.